The integration runtime (IR) is the compute infrastructure that Azure Data Factory uses to provide data-integration capabilities across different network environments. For details about IR, see Integration runtime overview.
A self-hosted integration runtime can run copy activities between a cloud data store and a data store in a private network. It also can dispatch transform activities against compute resources in an on-premises network or an Azure virtual network. The installation of a self-hosted integration runtime needs an on-premises machine or a virtual machine inside a private network.
Reference:
https://docs.microsoft.com/en-us/azure/data-factory/create-self-hosted-integration-runtime

Explanation:
Box 1:
Orchestration modes for Virtual Machine Scale Sets in Azure
Scale sets with Flexible orchestration
Achieve high availability at scale with identical or multiple virtual machine types.
With Flexible orchestration, Azure provides a unified experience across the Azure VM ecosystem.
Flexible orchestration offers high availability guarantees (up to 1000 VMs) by spreading VMs across fault domains in a region or within an Availability Zone.
Box 2: A capacity reservation group
On-demand capacity reservation enables you to reserve compute capacity in an Azure region or an availability zone for any duration of time. Unlike reserved instances, you don't have to sign up for a one-year or three-year term commitment. You can create and delete reservations at any time and have full control over how you want to manage your reservations.
Reference:
https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets- orchestration-modes
https://learn.microsoft.com/en-us/azure/virtual-machines/capacity-reservation-overview

Microsoft identity platform enables the third-party applications to use the resources on behalf of the users. Users must grant their rights to the resources by providing consent to the app. The app should be registered with Azure AD, and tenant admins should define the organization Consent and Permissions for the Enterprise Applications.
To do that, from the Azure AD main panel, you select the Enterprise Applications under the Manage section. Then, on the Enterprise Application screen (Number 1), select the Consent and permissions item under the Security section (Number 2).

On the new Consent and permissions screen (Number 1) under the first tab - User consent settings (Number 2), you can select one of the three user consent options:
- Do not allow user consent (Number 3) - admin's consent would be required for all the registered apps.
- Allow user consent for apps from verified publishers, for selected permissions (Number 4) - admin should define the "low impact" permissions that user can consent to for the apps from the verified publisher or your organization. To define the "low impact" permissions, you click on the
"Select permissions to classify as low impact" link (Number 5) or select the second tab -
"Permissions classifications" (Number 7).
- Allow user consent for apps (Number 6) - all users can consent for the app's access to the organization's data.

Following the Microsoft recommendations, you need to advise the company to set up the "Allow user consent for apps from verified publishers..." option as the tool against malicious their-party applications.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/develop/application-consent-experience
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user- consent?tabs=azure-portal
https://docs.microsoft.com/en-us/azure/active-directory/develop/consent-framework

System-assigned: Some Azure services allow you to enable a managed identity directly on a service instance. When you enable a system-assigned managed identity, an identity is created in Azure AD that's tied to the lifecycle of that service instance. When the resource is deleted, Azure automatically deletes the identity. By design, only that Azure resource can use that identity to request tokens from Azure AD.
https://learn.microsoft.com/en-us/training/modules/design-authentication-authorization- solutions/9-one-design-managed-identities

Correct:
* Azure Data Factory
Incorrect:
* Azure Data Box
Microsoft Azure Data Box is a hardware appliance designed to allow customers to import or export large amounts of data-more than 40TB-into and out of Azure offline.
* Azure Database Migration Service
* Azure Logic App
* Data Migration Assistant (DMA)
Note:
You can use the Azure portal to create a data factory. Then you use the Copy Data tool to create a pipeline that copies data from Azure Blob storage to a SQL Database.
You can create a schedule trigger, specify a schedule (start date, recurrence, end date etc.) for the trigger, and associate with a pipeline.
Reference:
https://docs.microsoft.com/en-us/azure/data-factory/tutorial-copy-data-tool